FileBrowser Quantum versions before 1.3.3-stable and 1.4.2-beta contain a path traversal vulnerability (CWE-22) in the publicPatchHandler in backend/http/public.go. The vulnerability arises because the code joins user-supplied fromPath and toPath fields with a trusted directory path using filepath.Join, which collapses '..' segments before the sanitizer runs. As a result, the sanitizer does not detect traversal attempts, allowing file operations outside the shared directory. This vulnerability is exploitable by anyone with a public share link that has AllowModify=true, enabling unauthorized move, copy, or rename operations on files within the share owner's source root. This issue is related to a previously patched similar flaw in the bulk DELETE endpoint (CVE-2026-44542), but the PATCH handler was not updated until these fixed versions.

An attacker with access to a public share link that permits modification can exploit this vulnerability to move, copy, or rename arbitrary files outside the intended shared directory within the share owner's root. This can lead to unauthorized file manipulation, potentially compromising data integrity and confidentiality within the affected file system scope. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

This vulnerability has been fixed in versions 1.3.3-stable and 1.4.2-beta of filebrowser. Users should upgrade to these or later versions to remediate the issue. Since this is a self-hosted product, patching is the primary mitigation. No vendor advisory content contradicts this; therefore, upgrading is the recommended action.